From patchwork Thu Sep 29 22:29:26 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Rick Edgecombe X-Patchwork-Id: 12994683 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60877C4332F for ; Thu, 29 Sep 2022 22:30:50 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id 867F68D000F; Thu, 29 Sep 2022 18:30:49 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id 7CA008D000C; Thu, 29 Sep 2022 18:30:49 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 5F7598D0017; Thu, 29 Sep 2022 18:30:49 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (smtprelay0016.hostedemail.com [216.40.44.16]) by kanga.kvack.org (Postfix) with ESMTP id 4CC318D000C for ; Thu, 29 Sep 2022 18:30:49 -0400 (EDT) Received: from smtpin03.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 247D916137E for ; Thu, 29 Sep 2022 22:30:49 +0000 (UTC) X-FDA: 79966569018.03.DD63FFA Received: from mga02.intel.com (mga02.intel.com [134.134.136.20]) by imf02.hostedemail.com (Postfix) with ESMTP id 5FDAF8000F for ; Thu, 29 Sep 2022 22:30:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1664490648; x=1696026648; h=from:to:cc:subject:date:message-id:in-reply-to: references; bh=SiBonWtkwMqX0JsNUovdDLOqqHtXkkKku/WhNLKvM50=; b=NtcYnGaWnC3Jd7x87tdGSzVwyR5seXkMdwGPcblw45cmbs8Jg/RKKaop QNdNOTY5y9H049PI21dQgt2y/t+nCdCJo7vDrnpAtW858gFRnSIJ9Rm5d bOA4LO9HUN9pXCDS4ok5xlD/bf+b+ZmhlwSwXJUTf2i09GKiENf4vOd1Z XEbrDnvF5aewUHX7syOoWwb671EP3EkdyT7Hyb2z56FF7DjfGy/izGjNE u6H/QSDUwm1jmS6SGsH90zND2JVCCTdZ2quZ2mGMqeQA1/5iFVdi14SzL 6u1mPON4d3fxru9Vm7f756mCJ0On1oMjhQLXjNwkRXSGI69wFnemUnSxT w==; X-IronPort-AV: E=McAfee;i="6500,9779,10485"; a="289207549" X-IronPort-AV: E=Sophos;i="5.93,356,1654585200"; d="scan'208";a="289207549" Received: from fmsmga004.fm.intel.com ([10.253.24.48]) by orsmga101.jf.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Sep 2022 15:30:47 -0700 X-IronPort-AV: E=McAfee;i="6500,9779,10485"; a="691016342" X-IronPort-AV: E=Sophos;i="5.93,356,1654585200"; d="scan'208";a="691016342" Received: from sergungo-mobl.amr.corp.intel.com (HELO rpedgeco-desk.amr.corp.intel.com) ([10.251.25.88]) by fmsmga004-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 29 Sep 2022 15:30:46 -0700 From: Rick Edgecombe To: x86@kernel.org, "H . Peter Anvin" , Thomas Gleixner , Ingo Molnar , linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-mm@kvack.org, linux-arch@vger.kernel.org, linux-api@vger.kernel.org, Arnd Bergmann , Andy Lutomirski , Balbir Singh , Borislav Petkov , Cyrill Gorcunov , Dave Hansen , Eugene Syromiatnikov , Florian Weimer , "H . J . Lu" , Jann Horn , Jonathan Corbet , Kees Cook , Mike Kravetz , Nadav Amit , Oleg Nesterov , Pavel Machek , Peter Zijlstra , Randy Dunlap , "Ravi V . Shankar" , Weijiang Yang , "Kirill A . Shutemov" , joao.moreira@intel.com, John Allen , kcc@google.com, eranian@google.com, rppt@kernel.org, jamorris@linux.microsoft.com, dethoma@microsoft.com Cc: rick.p.edgecombe@intel.com Subject: [PATCH v2 29/39] x86/cet/shstk: Support wrss for userspace Date: Thu, 29 Sep 2022 15:29:26 -0700 Message-Id: <20220929222936.14584-30-rick.p.edgecombe@intel.com> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20220929222936.14584-1-rick.p.edgecombe@intel.com> References: <20220929222936.14584-1-rick.p.edgecombe@intel.com> ARC-Authentication-Results: i=1; imf02.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=NtcYnGaW; spf=pass (imf02.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 134.134.136.20 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com ARC-Seal: i=1; s=arc-20220608; d=hostedemail.com; t=1664490648; a=rsa-sha256; cv=none; b=saqBFJQka5+ullyF7wIP5h4mYeDpQmmRVlrguKPuxiyKra+w1XcIS7Pqkg6HldoCYXhSFG //JTD/4EJJAmgY2SvaJoYnEN+Fybykh925f9rv/1SrUST6BllZZFECUtp8wHSxBknf/RGe /X4+NBbH1cz+TDkA1ziDyYRD7ccPlBI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=hostedemail.com; s=arc-20220608; t=1664490648; h=from:from:sender:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:content-type: content-transfer-encoding:in-reply-to:in-reply-to: references:references:dkim-signature; bh=3ZitXXrtaYxB0tD0za+P/cxxrVrNMYR3JVP2kPtDJD0=; b=LncTJWCZAA7JeO9GMko9M38WxVnRafhtbcQQz351gnnoSRqQy8TdIUVaVzbcSaoTsxzG7J gjF5cWE6HzgHPuxhfU4bvdi6Y5FUzLkqmdZicPIz8eNeeIgSW8z5vNT3j7NRk8UhU+Jdol MqxjRLEuSibS7OsZhruOb+HYiE6NmF0= Authentication-Results: imf02.hostedemail.com; dkim=none ("invalid DKIM record") header.d=intel.com header.s=Intel header.b=NtcYnGaW; spf=pass (imf02.hostedemail.com: domain of rick.p.edgecombe@intel.com designates 134.134.136.20 as permitted sender) smtp.mailfrom=rick.p.edgecombe@intel.com; dmarc=pass (policy=none) header.from=intel.com X-Rspam-User: X-Stat-Signature: 41xqd81r3poahr985oquzwzkehazm1rn X-Rspamd-Queue-Id: 5FDAF8000F X-Rspamd-Server: rspam05 X-HE-Tag: 1664490648-271970 X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: For the current shadow stack implementation, shadow stacks contents easily be arbitrarily provisioned with data. This property helps apps protect themselves better, but also restricts any potential apps that may want to do exotic things at the expense of a little security. The x86 shadow stack feature introduces a new instruction, wrss, which can be enabled to write directly to shadow stack permissioned memory from userspace. Allow it to get enabled via the prctl interface. Only enable the userspace wrss instruction, which allows writes to userspace shadow stacks from userspace. Do not allow it to be enabled independently of shadow stack, as HW does not support using WRSS when shadow stack is disabled. From a fault handler perspective, WRSS will behave very similar to WRUSS, which is treated like a user access from a #PF err code perspective. Signed-off-by: Rick Edgecombe --- v2: - Add some commit log verbiage from (Dave Hansen) v1: - New patch. arch/x86/include/asm/cet.h | 2 ++ arch/x86/include/uapi/asm/prctl.h | 1 + arch/x86/kernel/shstk.c | 34 +++++++++++++++++++++++++++++-- 3 files changed, 35 insertions(+), 2 deletions(-) diff --git a/arch/x86/include/asm/cet.h b/arch/x86/include/asm/cet.h index 8c6fab9f402a..edf681d4843a 100644 --- a/arch/x86/include/asm/cet.h +++ b/arch/x86/include/asm/cet.h @@ -25,6 +25,7 @@ int shstk_disable(void); void reset_thread_shstk(void); int setup_signal_shadow_stack(struct ksignal *ksig); int restore_signal_shadow_stack(void); +int wrss_control(bool enable); #else static inline long cet_prctl(struct task_struct *task, int option, unsigned long features) { return -EINVAL; } @@ -38,6 +39,7 @@ static inline int shstk_disable(void) { return -EOPNOTSUPP; } static inline void reset_thread_shstk(void) {} static inline int setup_signal_shadow_stack(struct ksignal *ksig) { return 0; } static inline int restore_signal_shadow_stack(void) { return 0; } +static inline int wrss_control(bool enable) { return -EOPNOTSUPP; } #endif /* CONFIG_X86_SHADOW_STACK */ #endif /* __ASSEMBLY__ */ diff --git a/arch/x86/include/uapi/asm/prctl.h b/arch/x86/include/uapi/asm/prctl.h index 41af3a8c4fa4..d811f0c5fc4f 100644 --- a/arch/x86/include/uapi/asm/prctl.h +++ b/arch/x86/include/uapi/asm/prctl.h @@ -27,5 +27,6 @@ #define ARCH_CET_LOCK 0x4003 #define CET_SHSTK 0x1 +#define CET_WRSS 0x2 #endif /* _ASM_X86_PRCTL_H */ diff --git a/arch/x86/kernel/shstk.c b/arch/x86/kernel/shstk.c index 873830d63adc..fc64a04366aa 100644 --- a/arch/x86/kernel/shstk.c +++ b/arch/x86/kernel/shstk.c @@ -386,6 +386,36 @@ void shstk_free(struct task_struct *tsk) unmap_shadow_stack(shstk->base, shstk->size); } +int wrss_control(bool enable) +{ + if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) + return -EOPNOTSUPP; + + /* + * Only enable wrss if shadow stack is enabled. If shadow stack is not + * enabled, wrss will already be disabled, so don't bother clearing it + * when disabling. + */ + if (!feature_enabled(CET_SHSTK)) + return -EPERM; + + /* Already enabled/disabled? */ + if (feature_enabled(CET_WRSS) == enable) + return 0; + + fpu_lock_and_load(); + if (enable) { + set_clr_bits_msrl(MSR_IA32_U_CET, CET_WRSS_EN, 0); + feature_set(CET_WRSS); + } else { + set_clr_bits_msrl(MSR_IA32_U_CET, 0, CET_WRSS_EN); + feature_clr(CET_WRSS); + } + fpregs_unlock(); + + return 0; +} + int shstk_disable(void) { if (!cpu_feature_enabled(X86_FEATURE_SHSTK)) @@ -397,12 +427,12 @@ int shstk_disable(void) fpu_lock_and_load(); /* Disable WRSS too when disabling shadow stack */ - set_clr_bits_msrl(MSR_IA32_U_CET, 0, CET_SHSTK_EN); + set_clr_bits_msrl(MSR_IA32_U_CET, 0, CET_SHSTK_EN | CET_WRSS_EN); wrmsrl(MSR_IA32_PL3_SSP, 0); fpregs_unlock(); shstk_free(current); - feature_clr(CET_SHSTK); + feature_clr(CET_SHSTK | CET_WRSS); return 0; }